The open source security infrastructure platform that teams use for secrets, certificates, and privileged access management.
San Francisco, CA
Joined August 2022
- Tweets682
- Following23
- Followers6.3K
- Likes2.5K
Infisical retweeted
Even if you migrate to another provider, I highly recommend using @infisical to store your secrets and inject them directly into your runtime. You also have the ability to set up auto-rotation, etc.
Infisical retweeted
Maybe everyone should just be keeping their secrets with @infisical?
Infisical retweeted
If you’re a Railway user acting on today’s security incident, here are some best next steps:
> Rotate any potentially exposed secrets and credentials
> Review audit logs for suspicious access
> Set up automated rotation for DB credentials and API keys
> Use short-lived, dynamic credentials wherever possible
> Consider fetching secrets at runtime instead of storing them directly in Railway
@infisical supports automated rotation for 50+ secret types, dynamic secrets, and Railway secret sync if you need a place to start.
An urgent notice from the Railway team
blog.railway.com/p/security-…
Infisical retweeted
oh and we made this game too: infisical.com/403
Infisical retweeted
over the past few weeks, we leaked thousands of API keys across the NYC subway!
please don't try this at home.
Infisical retweeted
If you're using OpenCode, here's what I'd do following today's breach:
1. Rotate potentially exposed API keys immediately. (@infisical can automate rotation for OpenAI, OpenRouter, etc.)
2. Stop handing raw API keys to AI agents. Use a transparent proxy like Infisical Agent Vault instead.
3. Use dynamic secrets so database credentials are short-lived rather than permanent.
4. Review audit logs for suspicious activity and unauthorized access.
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
If you're giving agents API keys, you're doing it wrong.
Let's get that straight.
Most developers aren't aware of this hack but you can actually run coding agents without any API keys and substantially reduce any risk associated with agents leaking keys.
This is generally a best practice and we implement this using a transparent proxy at @infisical.
The general idea is that you scaffold the agent's environment to proxy all traffic through a transparent HTTP proxy. This is non-intrusive and covers all CLI, local MCP, LLM provider traffic.
On a more practical level this means:
- OpenCode invokes the GitHub CLI to raise a PR without holding a GitHub PAT.
- OpenCode connects to any LLM Provider (e.g. Anthropic) without holding any API key.
- You get the point.
We've open sourced Agent Vault which holds agent credentials as part of Infisical and Agent Proxy, the standalone companion transparent proxy that fetches back credentials and brokers them for agents like OpenCode.
Linking the docs below; you're welcome 👇
Agent Vault + Agent Proxy combo bombo lets you run coding agents without any LLM and API keys.
You're welcome :)
Most developers aren't aware of this hack but you can actually run coding agents without any API keys and substantially reduce any risk associated with agents leaking keys.
This is generally a best practice and we implement this using a transparent proxy at @infisical.
The general idea is that you scaffold the agent's environment to proxy all traffic through a transparent HTTP proxy. This is non-intrusive and covers all CLI, local MCP, LLM provider traffic.
On a more practical level this means:
- OpenCode invokes the GitHub CLI to raise a PR without holding a GitHub PAT.
- OpenCode connects to any LLM Provider (e.g. Anthropic) without holding any API key.
- You get the point.
We've open sourced Agent Vault which holds agent credentials as part of Infisical and Agent Proxy, the standalone companion transparent proxy that fetches back credentials and brokers them for agents like OpenCode.
Linking the docs below; you're welcome 👇
Infisical retweeted
Most developers aren't aware of this hack but you can actually run coding agents without any API keys and substantially reduce any risk associated with agents leaking keys.
This is generally a best practice and we implement this using a transparent proxy at @infisical.
The general idea is that you scaffold the agent's environment to proxy all traffic through a transparent HTTP proxy. This is non-intrusive and covers all CLI, local MCP, LLM provider traffic.
On a more practical level this means:
- OpenCode invokes the GitHub CLI to raise a PR without holding a GitHub PAT.
- OpenCode connects to any LLM Provider (e.g. Anthropic) without holding any API key.
- You get the point.
We've open sourced Agent Vault which holds agent credentials as part of Infisical and Agent Proxy, the standalone companion transparent proxy that fetches back credentials and brokers them for agents like OpenCode.
Linking the docs below; you're welcome 👇
Access denied. Credential required.
On October 21 at 1 PM ET, see how Agent Vault gives AI agents access to the services they need without ever exposing the credentials behind them
We’ll walk through Agent Vault live and show how it works with tools like Claude Code and Codex, and answer your questions.
Save your spot: infisical.com/webinars/live-…
Want an LGTM hat? Of course you do.
Quote tweet with a screenshot showing contributions from the last year and include your GitHub username.
The 50 people with the most contributions get a hat. Ties go to whoever entered first.
Enter by Friday at midnight ET.
U.S. only.
One entry per person.
A credential an AI agent can read, is a credential it can leak.
Introducing Agent Vault: a new Infisical product that lets Claude Code, Codex, and other agents call the APIs and services they need, without holding real credentials.
With Agent Vault:
> Your agents work as they normally do, with no code changes
> A prompt-injected agent can only reach preapproved HTTP services, down to exact methods and paths
> Agent sessions expire on a schedule you set, and every request is logged
Agent Vault is in preview now, on Infisical Cloud or self-hosted.
> Try it now: infisical.com/platform/agent… > Docs: infisical.com/docs/documenta…
> We’ll also be doing a live demo of Agent Vault on October 21: infisical.com/webinars/live-…
If your agents run in @daytonaio sandboxes, you can now manage their keys in Infisical alongside every other secret your team uses!
Infisical now syncs copies of secrets straight into Daytona's secret store. Daytona keeps the real values out of the sandbox, and Infisical keeps the secret values current. Rotate a key in Infisical and every sandbox that references it gets the new value on the next sync, with no changes to your create calls.
Available on all plans, including free!
